Privacy Policy

Last Updated: April 23, 2026

Our Core Privacy Promise

Your privacy is our foundation.

Military Transition Toolkit protects your data with industry-standard security measures. Your information is stored securely in our cloud database with encryption at rest (AES-256), encrypted connections (HTTPS/TLS), and row-level security ensuring only you can access your data.

1. How We Store Your Data

All user data is securely stored in our cloud database with industry-leading security:

Secure Cloud Storage (All Users)

Your data is securely stored in the cloud with bank-level encryption. This enables automatic backup and access from any device while maintaining complete privacy and security.

Bank-level encryption (AES-256) protecting all data at rest
Row-level security ensuring users can only access their own data
Automatic cloud backup and sync across all devices
Secure SSL/TLS encryption for all data in transit
SOC 2 Type II certified infrastructure (Supabase)
HIPAA-compliant security for medical information
Regular automated backups with point-in-time recovery

Data Isolation & Privacy

Every user's data is isolated at the database level through row-level security (RLS). This means database queries automatically filter to show only your data.

Row-level security prevents cross-user data access
We never sell or share your personal data with third parties
Not a medical device: MTT is a documentation and planning tool — not a diagnostic, treatment, or clinical records system. Always consult your VA representative or physician for medical decisions.

Health-Related Information You Enter

The VA Claims Builder, MedBoard Checklist, and related tools intentionally let you record health-adjacent information so you can organize your claim before filing with the VA. This can include:

Medical condition names you plan to claim
Symptoms, frequency, and functional limitations
Pain level (0–10) and treatment history you self-report
Notes about in-service incidents related to a condition
Estimated VA disability ratings (your own estimate, not an official one)

How we handle it:

Stored encrypted at rest (AES-256) in our Supabase database
Encrypted in transit (TLS 1.2+) between your device and our servers
Row-level security so only you can read your own health records
Never sold, shared with advertisers, or used to train AI models
Not transmitted to the VA or any third party without your explicit action
Deletable at any time (see Section 6)

2. What Data We Collect

Personal Information

We collect minimal information necessary to provide secure cloud services:

Email address: For account creation, login, and service communications
Encrypted user data: Your transition planning data, securely encrypted in our database
Profile information: Name, military branch, rank, MOS (only what you choose to provide)

What We DON'T Collect or Sell

Device identifiers or precise location data
Behavioral tracking across other websites
We never sell any user data to third parties

Data you enter (VA claims, appointments, timeline tasks, medical condition notes) is stored encrypted in our database under your own account. See Section 1 for how health-related information is specifically handled.

3. Anonymous Analytics (Optional)

We use Google Analytics to understand basic usage patterns. This helps us improve the tool. The analytics collect:

Page views (which pages are visited)
Approximate geographic location (city/state level, not precise)
Device type (desktop, mobile, tablet)
Browser type (Chrome, Firefox, Safari, etc.)
How users navigate through the site

Analytics data is:

Completely anonymous - no personal identifiers
Aggregated - we only see trends, not individual sessions
Limited - Google Analytics only tracks page views, not form content
Optional - you can block analytics with browser extensions or do-not-track settings

4. Data Security

We implement industry-standard security practices to protect your information:

✓

Encryption at Rest (AES-256):Your data is encrypted in our database using AES-256 encryption, the same standard used by banks and government agencies.

✓

HTTPS/TLS Encryption in Transit:All connections use SSL/TLS encryption to prevent eavesdropping during transmission.

✓

Row-Level Security:Database policies ensure you can only access your own data. Other users cannot see your information.

✓

SOC 2 Compliant Infrastructure:Our database provider (Supabase) maintains SOC 2 Type II certification with regular security audits.

✓

Secure Authentication:Passwords are hashed (never stored in plain text) and we support secure session management.

5. Data Retention

Your encrypted data is retained in the cloud:

As long as your account is active
For 90 days after account deletion request (grace period for reactivation)
Permanently deleted upon your request or after the grace period
You can export your data at any time before deletion

6. Your Privacy Rights

You have complete control over your data:

Right to Access

Export your data in multiple formats at any time from your account settings

Right to Delete

You can permanently delete your account and all associated data in three ways:

Web: militarytransitiontoolkit.com/delete-account
Mobile app: Profile tab → Danger Zone → Delete Account
Email: support@militarytransitiontoolkit.com

Right to Portability

Export your data in standard formats (JSON, PDF, CSV) to use elsewhere

Right to Privacy

Row-level security and encryption protect your data from unauthorized access

7. Third-Party Services

We use these external services:

Google Sign-In (OAuth)

Purpose: Optional way to sign in or create your account

What they share: If you choose "Continue with Google," Google verifies your identity and provides your name and email address so we can create your account. We never receive your Google password. You can always use an email and password instead.

Google Analytics

Purpose: Anonymous usage statistics

What they collect: Anonymous page views, device type, approximate location

Cloud Storage Provider (Supabase)

Purpose: Store user data securely with encryption at rest

What they store: Your account data, transition planning data, protected by row-level security

AI Provider (Anthropic)

Purpose: Powers the site's optional AI features (such as Ask MTT and the AI claim-statement drafting tool)

What they process: When you choose to use an AI feature, the text you enter is sent to Anthropic's API to generate a response. Per Anthropic's commercial API terms, your inputs are not used to train AI models. Please do not enter SSNs, full dates of birth, or other sensitive personal information (the tools also screen for these).

We do NOT use: social media trackers, advertising networks, data brokers, or marketing platforms.

8. Cookies and Similar Technologies

We use minimal cookies:

Essential Cookies (Required)

Necessary for the site to function, including authentication and preference storage.

Analytics Cookies (Optional)

Google Analytics cookies track anonymous usage patterns. You can disable these with browser settings or privacy extensions.

Advertising Cookies (Optional)

Some pages are supported by display advertising served through Mediavine (via its Grow loader) and its programmatic ad partners. These partners may set cookies or similar identifiers to serve and measure ads and limit repetition. Where required by law, a consent tool lets you accept or decline this, and you can opt out via the industry tools at optout.aboutads.info and youradchoices.com. We do not receive or store the personal data these advertising partners process. See How We Make Money.

Mediavine Programmatic Advertising (Ver 1.1)

The Website works with Mediavine to manage third-party interest-based advertising appearing on the Website. Mediavine serves content and advertisements when you visit the Website, which may use first and third-party cookies. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a “device”) by the web server so that a website can remember some information about your browsing activity on the Website.

First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, “Tags”) may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser’s cache. The “help” feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser’s cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.

Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.

The Website collects the following data using a cookie when serving personalized ads:

IP Address
Operating System type
Operating System version
Device Type
Language of the website
Web browser type
Email (in hashed form)

Mediavine Partners (companies listed below with whom Mediavine shares data) may also use this data to link to other end user information the partner has independently collected to deliver targeted advertisements. Mediavine Partners may also separately collect data about end users from other sources, such as advertising IDs or pixels, and link that data to data collected from Mediavine publishers in order to provide interest-based advertising across your online experience, including devices, browsers and apps. This data includes usage data, cookie information, device information, information about interactions between users and advertisements and websites, geolocation data, traffic data, and information about a visitor’s referral source to a particular website. Mediavine Partners may also create unique IDs to create audience segments, which are used to provide targeted advertising.

If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit National Advertising Initiative opt out page. You may also visit Digital Advertising Alliance website and Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance’s AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.

For specific information about Mediavine Partners, the data each collects and their data collection and privacy policies, please visit Mediavine Partners.

We do NOT use cookies to sell your personal data, or to identify you as an individual beyond the authentication needed to run your account.

9. Mobile Apps

The Military Transition Toolkit mobile apps for Android (Google Play) and iOS (App Store) share the same Supabase backend as the web app. Data you enter on one device syncs to the others through your account.

Mobile-specific data

Authentication tokens — stored in your device's secure keystore (iOS Keychain / Android Keystore via expo-secure-store), never in plain text
Push notification token — optional; only collected if you grant notification permission. Used to remind you about upcoming separation-related deadlines. Never shared with third parties.
Local cached data — your VA conditions, timeline items, and profile are cached on-device so the app works offline. Cached data is cleared on sign-out or app uninstall.

Permissions we request

Notifications (optional) — to deliver timeline reminders. You can deny or disable at any time in your device settings; the app still works without them.
Internet / network access (required) — to sync data with our Supabase backend.

We do not request camera, microphone, location, contacts, SMS, call logs, or biometrics.

Deleting your account from mobile

Open the Profile tab in the mobile app and tap Delete Account in the Danger Zone section. This permanently removes your account and all data. You can also delete via the web form at militarytransitiontoolkit.com/delete-account.

9. Children's Privacy

Our service is not directed to individuals under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately.

10. International Users

Our security-first approach ensures compliance with major privacy regulations:

GDPR (European Union): We use privacy-by-design principles and provide full data control rights
CCPA (California): We don't sell personal information and provide full transparency
Other Jurisdictions: Our security measures meet or exceed most privacy requirements globally

11. Data Breach Notification

In the unlikely event of a security breach:

We will notify affected users within 72 hours
Data encrypted at rest provides an additional layer of protection
We will provide clear guidance on any necessary actions
We recommend changing your password if notified of a breach

12. Changes to Privacy Policy

We may update this Privacy Policy occasionally. Changes will be posted on this page with an updated "Last Updated" date.

Material changes will be announced on the home page and via email to all users. Your continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

support@formationlabs.dev

We aim to respond to all privacy inquiries within 48 hours.

Summary

In Plain English:

✓ Your data is stored securely in our cloud database with AES-256 encryption
✓ Row-level security ensures only you can access your data
✓ We only track anonymous page views for site improvement
✓ You have complete control over your information - export or delete anytime
✓ We'll never sell your data - 100% free for all servicemembers and veterans
✓ Health info you enter (symptoms, pain level, treatments) is encrypted and only visible to you
✓ 100% free - optional donations welcome but never required

Back to Home Go to App